Secure Client NAM prompt for credentials

[peter.matuska1]

Hi,

we have implemented EAP-FAST with machine (eap-tls) and user authentication (MSCHAP). Secure client 5.0.05040. Everything works fine but one user is reporting that sometimes when he logs in, the secure client shows him error: An authentication error occurred for network. Please try again. If the issue persists, contact your administrator. When he selects the network in secure client, secure client, he is prompted him to enter username and password. After that the network starts working. ISE logs doesnt show any problem with 802.1x. The authentication ends up in the MAB as expected when 802.1x is not responding. Switch shows log: No response from client.

Has anyone had this issue before?

thank you

[ahollifield]

Are you using PEAP as an inner method?  Any reason not to move to TEAP?

[peter.matuska1]

we are using EAP-FAST and mschap for user auth and eap-tls for machine auth. 

And I have better experience with anyconnect nam than with native supplicant.

[ahollifield]

What’s the use case for counting to use PEAP? Why not EAP-TLS? What version of AnyConnect? What version of Windows?

[peter.matuska1]

We use MSCHAP fo ruser authentication because of issues with user's certificate distribution, logging of users who are not in AD and thus doesnt have certificate.

The issue is with Secure client 5.0.05040 on Win 10.

thank you

[ahollifield]

Credential Guard was the first thing that came to my mind.  I would highly suggest looking at certificate authentication instead.  I would also consider an upgrade to Secure Client 5.1 as well.

[peter.matuska1]

credential guard is disabled. 5.1 didnt work in their network.

[ahollifield]

Why? What happened with 5.1?

[azurcher5516]

We are experiencing this as well. We have updated all of our users to Cisco Secure Client v 5.1 and very small amount of users (3) have reported this. It happens to some more often than others. Any find a root cause?